Sovereign by default, modern by design.

— 01

AI in citizen services has become a Cabinet-level conversation

From DTA AI guidance to agency-specific responsible-AI frameworks, the question has shifted. No longer whether to use AI. Now how to evidence it. Boards and ministers want ongoing proof, not vendor demos.

— 02

Sovereignty is now a hosting decision, not a slogan

The hosting framework providers, in-country residency, and supply-chain transparency now sit on the procurement scorecard. Moving legacy workloads is a sovereignty programme as much as a cloud one.

— 03

Cyber expectations have moved from paper to substance

Baseline readiness, PSPF Policy 10, ISM control mapping, and incident reporting timelines now flow into ministerial accountability. Programmes need defensible substance, not paper sign-off.

Responsible AI for the public sector

AI policy alignment, ethical risk review, and evidence packs mapped to the DTA AI Framework and agency responsible-AI policies.

Australian-hosted cloud foundations

Azure, AWS, and Google cloud foundations designed against the hosting framework, ISM, and agency-specific control overlays.

IRAP-ready architecture

Reference architectures and prep work so assessments run in weeks, not quarters.

Cyber readiness & PSPF uplift

Baseline uplift, PSPF Policy 10 alignment, and ISM control mapping with evidence packs ready for the Cyber Hub.

Identity & access modernisation

Modern identity controls, conditional access, privileged access management, and federation patterns suited to whole-of-government identity.

Critical infrastructure & the SOCI Act

Risk-management plan design and uplift for agencies operating critical assets including energy, water, transport, and communications.

The landscape we read

Government is both the regulator of AI and one of its most active adopters.

The Australian Government is mandating AI adoption across the public service while simultaneously building the regulatory frameworks that will govern AI use by others. Holding both positions at once demands that government lead by example, with transparent oversight, clear accountability, and security foundations that withstand public scrutiny.

220,000+

APS employees required to undertake AI literacy training under the APS AI Plan 2025

Department of Finance, November 2025

7,600+

APS staff who participated in the DTA whole-of-government Copilot trial across more than 60 agencies (Jan–Jun 2024)

DTA Copilot Trial Evaluation, October 2024

86%

Of Copilot trial participants wanted to keep using the tool; 69% reported faster task completion

DTA Copilot Trial Evaluation, October 2024

~60%

Of trial participants had to make moderate to significant changes to AI-generated output before it could be used

DISR mid-trial survey / DTA evaluation, 2024

Data sovereignty

Sensitive government data flowing through commercial AI platforms

The APS AI Plan acknowledges the question of what information enters commercial AI services and how it is handled. GovAI Chat is intended to provide a sovereign alternative for OFFICIAL-level use, but staff use of public AI tools remains a real oversight concern.

Public AI tools used for OFFICIAL or higher-classification material
Vendor data handling arrangements without clear audit rights
Cross-jurisdictional data flows in cloud-hosted AI services

Accountability and explainability

Automated decisions affecting citizens without explainable reasoning

Robodebt set the public expectation that automated government decisions must be explainable, contestable, and subject to human oversight. Any AI system that touches citizen entitlements, compliance, or services carries that burden, whether it was designed to or not.

AI used in citizen-facing decisioning without documented oversight
Lack of an explanation surface for individuals affected by AI-supported decisions
Insufficient audit trails for AI-assisted policy and casework outputs

Workforce and adoption

AI tools in use ahead of the training and oversight to support them

The APS AI Plan brings mandatory AI literacy training for all 220,000+ public servants. In the meantime, the Copilot trial showed that the most confident and effective users were those who received tailored, multi-channel training. Staff using AI without training is a real and current risk.

Inconsistent AI literacy across agencies and classifications
Use of AI tools without clear guidance on appropriate scope
Output quality issues going undetected in agencies without strong review practices

Proof points

Artefacts your assurance team will recognise.

AI evidence pack mapped to the DTA AI Framework, agency responsible-AI policy, and ISM controls.
Hosting-framework-aligned cloud foundation, with control mappings ready for assessment.
PSPF Policy 10 and baseline readiness uplift sequenced over a financial-year window.
Modern identity reference architecture aligned to whole-of-government identity strategy.
Risk-management plan design and reporting packs for designated critical-infrastructure assets.
Procurement-ready evidence documentation for panel arrangements.

We work to the major Australian rules for government IT. The PSPF and ISM set the security baselines. The Hosting Certification Framework covers cloud and managed-service providers. IRAP assessments validate services for agency use. The SOCI Act and Essential Eight apply on top. See the glossary for what each one covers and when it bites.

Briefing

How do NDIS providers prove who submitted a claim?

NDIS claim attribution: the NDIA can withhold payment until a claim is substantiated, and an API audit trail may name your organisation, not a person.

25 Aug 2026 · 12 min

Briefing

How do you get value from AI that you can defend?

A secure AI integration and a trustworthy one are different builds. What Australian organisations need in place before AI produces value they can defend.

15 Aug 2026 · 20 min

Briefing

What does a modern data platform need to look like before AI can use it?

A modern data platform is designed from the consumption layer backwards. What Australian organisations must change before AI can use their data.

1 Aug 2026 · 15 min

All insights →

— 01

Sovereign by default, modern by design.

Three pressures defining the next term of government IT.

AI in citizen services has become a Cabinet-level conversation

Sovereignty is now a hosting decision, not a slogan

Cyber expectations have moved from paper to substance

Capabilities aligned to PSPF, ISM and the hosting framework.

Responsible AI for the public sector

Australian-hosted cloud foundations

IRAP-ready architecture

Cyber readiness & PSPF uplift

Identity & access modernisation

Critical infrastructure & the SOCI Act

Government is both the regulator of AI and one of its most active adopters.

Sensitive government data flowing through commercial AI platforms

Automated decisions affecting citizens without explainable reasoning

AI tools in use ahead of the training and oversight to support them

Artefacts your assurance team will recognise.

The rules we work to.

Recent articles for government.

How do NDIS providers prove who submitted a claim?

How do you get value from AI that you can defend?

What does a modern data platform need to look like before AI can use it?

Service offerings most relevant to government.

AI services

Data services

Cloud services

Cyber security

Critical infrastructure

8 other sectors. Same converged practice.

Financial Services

Superannuation

Health

Education

Data Centre Providers

Care Services

Critical Infrastructure Operators

Growing Businesses

Talk to us about your government programme.